Posted
by
timothy
on Monday June 18, 2012 @08:09AM
from the willie-sutton's-modern-corollary dept.

Sparrowvsrevolution writes "Governments are sticking their noses into Google's servers more than ever before. In the second half of 2011, Google received 6,321 requests that it hand over its users' private data to U.S. government agencies including law enforcement, and complied at least partially with those requests in 93% of cases, according to the latest update to the company's bi-annual Transparency Report. That's up from 5,950 requests in the first half of 2011, and marks a 37% increase in the number of requests over the same period the year before. Compared with the second half of 2009, the first time Google released the government request numbers, the latest figures represent a 76% spike. Data demands from foreign governments have increased even more quickly than those from the U.S., up to 11,936 in the second half of 2011 compared with 9,600 in the same period the year before, though Google was much less likely to comply with those non-U.S. government requests."

There's far more information to request. Whether or not you agree with the notion of government requests for information, would you really expect requests to remain flat, or go down, when the pool from which information is being requested is getting dramatically larger? Yes, it's newsworthy -- that's why you're reading this story -- but it's not inappoprtiate.

It's a request -- it is not illegal for the the US government to make a request of a business. It has never been illegal, and this is not some kind of "post-9/11" construct as some will assert. Government has been able to ask business for assistance since the founding of our country, and it does not run counter to the letter or spirit of the Constitution. Government is part of our society, and it is lawful for it to communicate with other components of our society.

Government cannot compel a particular response without a warrant or court order: Google is not obligated to respond to the a request that is not accompanied by a warrant or court order in any particular way. Google may CHOOSE to comply with a request because there is nothing inappropriate about a business deciding to comply with a lawful request from a government agency. Fortunately, if you don't like Google's policy, you can choose not to use it.

In other words, if you have an issue with Google complying with a US government request, your problem isn't with the US government -- it's with Google.

Google policy analyst Dorothy Chou told me in an interview prior to the data’s release that one example of the requests might be for the IP addresses of users who log into their Google accounts, which law enforcement agents use to locate individuals involved in criminal cases such as kidnapping.

She says Google requires that the requests are submitted in a written form, come from the appropriate agency, cite a criminal case and are sufficiently narrow in their demands in terms of which users are affected and what time frame of data is requested. "The data can often be very critical to a case," says Chou. "We want to show that we're advocating on your behalf. But we also want to do right by the spirit and letter of the law."

[...]

"We noticed that government agencies from different countries would sometimes ask us to remove political content that our users had posted on our services. We hoped this was an aberration. But now we know it’s not," reads the post from Google’s Chou. "Just like every other time before, we've been asked to take down political speech. It’s alarming not only because free expression is at risk, but because some of these requests come from countries you might not suspect—Western democracies not typically associated with censorship."

For example, in the second half of last year, Spanish regulators asked us to remove 270 search results that linked to blogs and articles in newspapers referencing individuals and public figures, including mayors and public prosecutors. In Poland, we received a request from a public institution to remove links to a site that criticized it. We didn’t comply with either of these requests.

"Spying" would be requesting information more than once on the same individual. Although I am sure that there are several cases here that could be classified as "spying", these numbers do not directly support your assertion. It is probably closer to 100 individuals than 10,000 individuals.

Most of these responses probably helped eliminate a suspect from an investigation. Some responses helped incriminate the individual.

Google is quite transparent and forthright about these requests and responses. Do they

well we have a few thousand murders in the USA every year and last month there was one in florida where the perps googled how to kill someone right before they did it. add in all the drug dealers and organized crime and 20,000 per year is not a big deal

To protect our rights from police abuses. We require police to get a warrant from the courts to ensure that there is no single branch of government that can unilaterally violate your privacy or freedom. We do not want the police running around making their own decisions; the judge that signs a warrant is supposed to be a check against an out-of-control police force.

If a police officer, in his normal line of duties, were to ask me some questions, I have every right to choose whether or not to cooperate and provide him the information he seeks. I can either answer him or tell him to put me under arrest and get me a lawyer. Really, I don't even have to acknowledge his presence as long as I do nothing to obstruct him directly.

What I see going on in TFA is pretty much the same thing by analogy. The "citizen" is Google and the "police" are the government. IANAL, obvi

The problem is that Google has access to a vast amount of information about US citizens. Let's put it this way: if you and I are communicating using gmail, and the police come to you and demand copies of the emails I sent you and you refused, they would just go to Google. They would not have to seek a court order of any sort to get the information they want. Suppose instead that you and I send paper mail to each other, and the police demand the letters I sent you. Short of a court order compelling you

But the CONTENT of the communications of US Persons does require a warrant — that is the law, and that was made more even more explicit with the FISA Amendments Act of 2008: the acquisition, storage, analysis, dissemination, etc., of the content of the communications of US Persons anywhere on the globe requires an individual and properly adjudicated warrant from a court of competent jurisdiction. Before, communications outside the US, even of US Persons outside of the US, were sometimes in a gray area

Sure, but everything I said is equally true of the headers, which as I remember do not require a warrant or court order. The headers contain non-trivial information, and could potentially be presented to a judge in order to obtain a warrant (the "snowballing" effect). No matter how you slice it, the power of the police has been expanded here.

What you're looking for is a contract with an email provider that says they won't store your email after you mark it for deletion and they won't provide any of your information to anybody unless you tell them to or they have a court order.
I think the right place for a complaint is with Google. But you know what their business practices are so you know they're not about to make such an agreement.

Some of the best officers I remember, or have heard of very often asked for rather than directly ordered things. It was more a case of "Please take your unit up there and do X." Afterwards there was "thank you".
If things got "stressful" the please and thank yous ceased but they returned as soon as normal communication volumes and speeds returned."

They may have included all the request words but they were orders none the less. They were in a position of power and politeness is a good way of ensuring co-operation. There are plenty lesser powers who feel they have to order everything. As they climb up society (or the ranks) they seem to become nicer.

Just because they are called "requests" does not mean that you have much leeway whether it is a captain telling people to head into danger or a suited spook asking for information that the owners might object to. You just have to do it.

I know some will say that not complying with such requests might have "consequences", the implication being that it really is a demand with which Google "must" comply; of course, this is an assertion with no proof, designed to deflect attention from the fact that it is in no way illegal or unconstitutional for the US government to make such requests. If you have a problem with a business responding to such a request, then your problem is with that business, not the government. The irony is that Google is telling you that it's doing this, while other businesses don't -- and they're under no obligation to do so, either.

If you were talking about a business in Russia, China, or Iran, you might have a point.

This is a clever trick in this debate — to claim that Google is essentially "forced" to comply with "requests" or it may not receive favorable government treatment.

It's clever, because it means you don't have to confront the truth, which is that there is nothing wrong with a government in a free society asking a business for help, and nothing wrong with a business deciding to provide that help. It's not illegal, and doesn't run afoul of the Constitution.

There is no "law" that says that Google has to comply with a US government request (that is not accompanied by a court order or a warrant) in any particular way.

Are you saying that the government should NEVER be able to have any communications with any other business or entity in the US, or make any kind of request, unless it is accompanied by the force of law and criminal penalties for noncompliance?

It's clever, because it means you don't have to confront the truth, which is that there is nothing wrong with a government in a free society asking a business for help, and nothing wrong with a business deciding to provide that help. It's not illegal, and doesn't run afoul of the Constitution.

You are ignoring the very real expectation that people have that their email will enjoy the same privacy as their postal mail and their phone conversations. Google does not make its policy of complying with US government requests clear to its users (it is an ambiguous statement buried in the privacy policy), and the US government has not been forthcoming about its cozy relationship with Internet companies. People have every reason to think that a court order would be required before the government can receive their information from Google, because that is how things work with their telephone conversations.

This is a legal loophole that should be closed, not defended. The Stored Communications Privacy Act was written before the Internet became a widely used medium of communication. At the time, most computer users understood how emailed worked and understood that their email was being sent in the clear through another person's computer system, and they did not have a reasonable expectation of privacy. That is not true today; the majority of computer users today have no idea how email works, they think of it as a fancy version of postal mail, and they have no understanding of the privacy implications of sending plaintext email (or that there is even an alternative). The logic behind the SCPA is twenty years out of date.

Yes, there is a problem with the government asking businesses for "help," when the purpose in doing so is to avoid legal and constitutional requirements. If Google did not comply with these sorts of requests, the government would have to either violate the law or turn to the court system to get wiretap orders and so forth. That is how the system is supposed to work: your communications are supposed to be private except when a warrant is issued, and warrants are not supposed to be issued unless probable cause can be shown. This friendly, "Hey Google, you think you could give us all the information you have about Joe Schmoe," system is not the sort of system we are supposed to have in this country.

Really, the idea that Google was pressured by the government is not that far-fetched, given the government's behavior in the past, and it is optimistic for Google -- the company that claims it will "do no evil." Sure, evidence is lacking, which is a result of the secrecy that surrounds police operations. We really do not know how these requests are being made. Is Google being pressured? Did Google propose the idea of this sort of relationship to the government? Does Google use its cooperation as a bargaining chip when it wants to build a new data center or lay some new fiber?

This is a matter of preserving the principles upon which the US was founded. The government is not supposed to be all-powerful, and the panopticon is not supposed to exist here. Our privacy is supposed to be violated only after a careful legal procedure, only after a judge is convinced of a legitimate investigative need.

Great reply — one of the increasingly few thoughtful responses I get on slashdot these days.

To address your points, there are many exceptions to the warrant requirement. For example, the metadata or "envelope" of communications has generally been considered by the courts to be exempt from warrant requirements.

In the literal sense of an envelope, a warrant is not required for government to look at the outside of an envelope (e.g., addresses written on the envelope, or its size and shape or other external characteristics).

In the case of phone conversations, Smith v. Maryland (1979) said that things like the list of phone calls received, or numbers called, or for how long, were part of phone company billing records and a warrant was not required.

In the context of the internet, a warrant is not required for communications metadata — IP addresses, DNS names, To: and From: addresses on an email message, and similar.

It is the CONTENT of communications that requires a warrant. The words written in a letter; the words spoken on a phone call; the words contained in an email message or VoIP call.

So, if these kind of non-content requests don't require a warrant, and have longstanding analogues in the non-digital realm upheld by the Supreme Court, what is wrong with making these requests in the digital realm?

Some might say that a much more complete picture of a person can be constructed from increasing activities in the digital realm, even without the benefit of the content of communications. Certainly I would agree. Does that automatically make it illegal, immoral, or wrong? It's definitely not illegal or unconstitutional (it isn't illegal until a law says it is, and it isn't unconstitutional unless a court of competent jurisdiction says so; and these examples above are explicitly held as constitutional), so is it immoral or wrong? If the government has legitimate interests here, and legitimate charges to execute the law, the real question is just how far that authority goes.

It would be ridiculous to assert that any contact with business by government in a free society be accompanied by force of law. It would be similarly ridiculous to allow for the provision of any and all information the government asked for without a warrant. So the balance is clearly somewhere between these two extremes. Currently the balance is a result of the fact that there are numerous and longstanding (i.e., not "post 9/11) exemptions to the requirement for a warrant for written (mail), voice (telephone), and digital (internet) communications.

Security and liberty are not at two ends of a zero-sum sliding scale. We can and should have a good measure of both.

So, if these kind of non-content requests don't require a warrant, and have longstanding analogues in the non-digital realm upheld by the Supreme Court, what is wrong with making these requests in the digital realm?

The fact that the analogues are not quite identical. Sure, without a warrant the government can look at an envelope while a letter is in transit; the problem here is that the emails are not being inspected while they are in transit, but rather when they are stored on a server. Postal mail is not copied and saved by each courier that delivers it; email is. You can be reasonably certain that once a postal letter is delivered, nobody will get the chance to inspect or make a copy of the envelope; yet even after receiving an email, the message may be stored on one or more servers for indefinite periods of time, during which the server operator may have a chance to comply with such requests.

These systems are also automated and integrated to a degree that far exceeds previous systems. I could visit a website that appears to have nothing to do with Google, but without my knowledge Google could have recorded that visit. It would be as if each store you shopped at had dozens of security cameras, which were operated by dozens of different entities -- and the police could potentially ask any one of those entities to play back the footage. One website's operators may not be willing to comply with a police request and might demand a court order; the police could simply go to some other entity and receive the same records. It is reasonable to expect Slashdot's readership to be cognizant of this sort of thing; it is unreasonable to expect the majority of Americans, who have little understanding of computers, to be equally informed.

It would be ridiculous to assert that any contact with business by government in a free society be accompanied by force of law

Sure, but we are not talking about any old contact, we are talking about contact that is specifically related to law enforcement activities. We need to be careful when it comes to law enforcement power; too little power would be detrimental to public safety, but too much invites various abuses and tyranny. I have noticed a pattern, and I do not think I am the only one, where increases in police power are followed up with increases in the number of laws and the number of ways people can become criminals. Put another way, the trend is for the police to be pushed to their maximum capacity to enforce the law, regardless of what that capacity is.

Currently the balance is a result of the fact that there are numerous and longstanding (i.e., not "post 9/11) exemptions to the requirement for a warrant for written (mail), voice (telephone), and digital (internet) communications.

I would say that as early as the 1970s, the police were given too much power at the expense of our civil rights and liberties. People generally point to 9/11 as a turning point; they ignore other turning points, like CALEA (which mandates that wiretapping capabilities be built into our phone system, among other things), the Comprehensive Crime Control Act (which allows the police to recycle seized assets into their own budgets), and the Controlled Substances Act (which gives the Attorney General's office the power to declare drugs illegal without any democratic process). Each of these laws has been detrimental to our civil rights, and in each case the power of the police was increased, then followed up with an increase in the number of reasons the police can have to arrest people (the most obvious case of the this is the CSA, which has resulted in the list of illegal drugs growing and never shrinking -- and drug cases are one of the cited reasons for the requests being made to Google).

The beauty of your argument is you don't need "proof"; you can just say, "Hey, intuitively, I believe that Google 'has' to help or else the government would screw them; therefore this is 'wrong'," without having anything whatsoever to back up that argument

Hey, intuitively, I believe that AT&T 'has' to provide warrentless wiretaps or else the government would screw them.

As for Google, it's really difficult to say. I expect it's just easier for them to comply with the requests. I may find it offensive

Government cannot compel a particular response without a warrant or court order: Google is not obligated to respond to the a request that is not accompanied by a warrant or court order in any particular way. Google may CHOOSE to comply with a request because there is nothing inappropriate about a business deciding to comply with a lawful request from a government agency.

If I had the mod points, I'd mod you up. This is an important distinction.

My guess is that Google wants to keep the feds on their good side. Google is getting rather large and wants to make sure that the Feds remember that Google helps them "catch terrorists". Unlike the populous, the federal government has long memories and can hold grudges for long periods of time.

Fortunately, if you don't like Google's policy, you can choose not to use it.

This is easier said than done. Google, like Facebook, has become tightly integrated with our society, so much so that it's weird when I see product placements for other search engines on shows and movies. I can't remember the show but I remember seeing a product placement for Yahoo search. I remember saying out loud, "Who still uses Yahoo?"

I would say it's easier to simply not register an account on Google. However, they may still know who you are based on your browser fingerprint [eff.org].

This is easier said than done. Google, like Facebook, has become tightly integrated with our society

I wouldn't go so far as to say Google is independently having societal ramifications, but I definitely agree that avoiding them is becoming harder and harder to do. Google Analytics is all but ubiquitous across the commercial net, as is Facebook, and they build profiles of users even if they're not logged in [dailymail.co.uk] to any of their services, which obviously means they're tracking your activity either way.

This is why I always give the friends and family I do computer tech support for a primer on NoScript. Adblock P

That is an issue all by itself, because it implies that the government can hold a grudge against companies. This means companies (and thus the people in charge of those companies) are afraid of the government.

Where I work (in Belgium) we get regular requests from the government and police and what not. Unless they have a court order, what we basically say is "Sod off". I know of one situation where police officers where escorted out of the bu

Oh, I'm sorry — I thought you had some proof, but it's just the standard diversion to avoid confronting the fact that there is nothing illegal, unconstitutional, or immoral with a government in a free society asking a business for help, and nothing wrong with a business deciding to voluntarily provide that help.

This is Qwest claiming it was punished for not participating in an early iteration of the long-defunct TSP. If that's true, then would it not stand to reason that AT&T should have received the most government contracts in response? Except two other telecom operators were ahead of them.

Google is not claiming it was or will be punished; in fact, it is taking great pains to explain that its cooperation is voluntary. The Qwest CEO's claims do not mean that Google feels it is being pressured, and doesn't add

I didn't say he was lying, and I didn't say he was misquoted. I didn't even imply that. I'm quite sure he believed Qwest's reluctance to participate was directly responsible for it losing contract dollars.

What I said was there is that even that isn't "proof" of anything; yes, we can certainly sit here and infer all day long, and I agree that there is a certain quid pro quo in all human interactions.

But if we're going to use government contract awards as the sole yardstick of "reward" for a business complyin

But 'demand' is such an ugly word... doesn't "offer you can't refuse" sound much friendlier?

look up euphemism.

And one of my favourite movie quotes:

James Bond: [thinking] Mr. Ling, the Red Chinese at the factory, he's a specialist in nuclear fission... but of course! His government's given you a bomb.Auric Goldfinger: I prefer to call it an "atomic device."

Government has been able to ask business for assistance since the founding of our country, and it does not run counter to the letter or spirit of the Constitution

And that's a huge part of what is wrong with this country. The government should have absolutely no special priviliges, unless it gets a warrant. If I can't do it, neither should the FBI, unless they can convince a judge that it's OK. No exceptions.

I can't get information from Google, because Google will say no. If I can't do it, the government shouldn't be able to do it without a warrant. Therefore, the government should have to get a warrant before accessing any information that isn't freely available to the public at large.

If I wasn't clear, I was talking about what should be, not what is. Our government already has way too much power. We need more restrictions written into the constitution, and making warrants mandatory for all non-public information would be an effective and fair check on government power.

Bullshit.
The government, or anyone else for that matter, can "request" anything. Yes, even things that, were they to be handed over the by the entity receiving the request, would be a clear-cut violation of the U.S. Constitution. Absent a warrant, issued in by a real court and according to due process, the violation of our privacy, by a company who entered into a contract to keep it private, is unconscionable. "We just want to keep the government happy", as appears to be Google's lame excuse, does not cut

Government cannot compel a particular response without a warrant or court order: Google is not obligated to respond to the a request that is not accompanied by a warrant or court order in any particular way. Google may CHOOSE to comply with a request because there is nothing inappropriate about a business deciding to comply with a lawful request from a government agency. Fortunately, if you don't like Google's policy, you can choose not to use it.

Google may CHOOSE to comply with a request because there is nothing inappropriate about a business deciding to comply with a lawful request from a government agency.

And how does Google determine if the request is lawful or not? "I'm from the government, I need that data because it's related to a criminal case" isn't enough. Just because it's related to a criminal case doesn't mean the government has the authority or abillity to make the request.- there's a whole shedload of case and black letter law regar

With all these request I would have to assume Google and other companies have quite a few people dedicated to the process. How much is this sapping from industry as a whole to comply and at times refuse to comply with all these attempts to gather information? Call it a privacy tax or whatever, neither the loss of privacy or monies should be acceptable. Seems far too often in the US that the Constitution is only a reminder and not the law.

Seems far too often in the US that the Constitution is only a reminder and not the law.

It's neither illegal nor unconstitutional for the US government to make a request of business.*

Also, privacy and liberty are not at two ends of a zero-sum sliding scale: we can and should have a good measure of both.

* I know some will say that not complying with such requests might have "consequences"; of course, this is an assertion with no proof, designed to deflect attention from the fact that it is in no way illegal or unconstitutional for the US government to make such requests. If you have a problem w

It's neither illegal nor unconstitutional for the US government to make a request of business.*

When nearly all of our personal communication is controlled by a handful of businesses, these sorts of legal loopholes need to be closed. Times have changed, and the logic behind the loopholes that you are defending is no longer valid.

No, a 76% increase. "Spike" implies that it went up quickly and then immediately came back down, forming a spike on a graph. Thus only in the unlikely event that it comes back down next year can you legitimately call it a spike. Yes, I'm being picky.

DuckDuckGo.com [duckduckgo.com] is now my default search engine for exactly this reason. They simply don't keep historical search records that are identifyable to me. Of course, they too would have to legally comply with any government request, but their historical data is of little use.

While I trust Google to be as secure as can be reasonable, I do *not* trust the likes of the FBI (readup on National Security Letters [aclu.org]), or other TLAs that decide they have a bee in their crotch and want to through their legal weight around for little reason.

With NSA's warrantless wiretapping [eff.org] laws fully protected now, I don't trust the government to honestly care about my privacy. I trust Google to Do The Right Thing (TM), but they're hands are tied when the government wants something.

With all due respect, you are a naive fool. Do you work for DuckDuckGo? Have you administered their servers? You (and any other user) have absolutely no way of validating claims of 'we don't keep any records' by this company or any other. Anyone who takes such claims at face value might as well use Google as they are not really serious about protecting their privacy.

It's about calculated risk. Any of these sites I have to take on some level of faith. Anytime I connect to a public network I could be the victim of a man-in-the-middle attack. DuckDuckGo could be a black-ops honeypot for all I know.

What I do know is I'm taking a risk using either, and it seems to me the smaller risk is with DuckDuckGo. They're frontfacing claim is relatively sound theoretically, and they're a smaller target than Google. It's more probable in my view that DuckDuckGo "does what it says on

And that is exactly what the FBI, NSA, etc would like to have you thinking. That site X is a more secure/better alternative. What better a front is there to keep tabs on those who don't want them to know what they are doing?

That info would tend to leak. Depends how many "insiders" there are, and time, but even if you can't expect people to have a conscience, you can usually count on there being a couple of disgruntled former employees...

Given the massive increases in domestic surveillance, you'd expect that demands would decrease. This is very worrying. Perhaps the government needs more surveillance powers to catch teh pedo-terrorists.

Chilling to note that the real reasons Western democracies hadn't turned their countries into police states before had nothing to do with lofty ideals about freedom and the rule of law, but merely because of the modest hurdles of efficacy and transactional costs.